Critical PLC Exploits: Iran APT Targets US Infrastructure OT Devices

• CISA Advisory AA26-097A (April 7, 2026) confirms Iranian-affiliated APT actors actively exploit internet-facing Rockwell Automation/Allen-Bradley PLCs across U.S. critical infrastructure, causing operational disruption and financial loss.
• Attack vectors include malicious PLC project file interactions and manipulation of HMI/SCADA display data, with suspicious traffic on OT ports 44818, 2222, 102, and 502 originating from overseas hosting providers.
• If your organization operates internet-exposed PLCs — particularly in water/wastewater or government services — you face active, confirmed compromise risk today.

Last updated: April 15, 2026

Iranian APTs Are Inside U.S. Industrial Control Systems Right Now

On April 7, 2026, CISA published Advisory AA26-097A documenting an active campaign by Iran-affiliated advanced persistent threat actors targeting programmable logic controllers across multiple U.S. critical infrastructure sectors. The targets: Rockwell Automation and Allen-Bradley PLCs — devices that control physical processes in water treatment plants, government facilities, and other sectors where failure has real-world consequences.

This is not a theoretical vulnerability disclosure. CISA confirmed that these attacks have already caused PLC disruptions, operational shutdowns, and financial losses. The attackers manipulate PLC project files and alter data displayed on human machine interface (HMI) and supervisory control and data acquisition (SCADA) screens — meaning operators may not even realize their systems are compromised until physical processes behave unexpectedly.

An operational technology (OT) exploitation campaign refers to cyberattacks that target the hardware and software controlling physical industrial processes — pumps, valves, turbines, chemical dosing systems — as opposed to traditional IT network intrusions that target data. OT attacks carry inherently higher stakes because compromised controllers can cause physical damage, environmental harm, or endanger human safety.

For CISOs managing converged IT/OT environments, the attack surface just expanded in a way that demands immediate action.

How the Attack Works: PLC Project Files as Weaponized Payloads

The Iranian APT campaign exploits a fundamental weakness in how PLCs are programmed and maintained. Rather than targeting network protocols or firmware vulnerabilities directly, the actors interact maliciously with PLC project files — the configuration and logic files that define how a controller operates.

The Attack Chain

The campaign follows a pattern that exploits operational realities in most industrial environments:

1. Initial access: Attackers identify internet-facing PLCs through scanning. Rockwell Automation/Allen-Bradley devices are the primary targets, though CISA warns other branded PLCs may also be affected.
2. Project file manipulation: Once connected, actors modify PLC project files to alter controller logic — the instructions that govern physical processes.
3. HMI/SCADA display tampering: Attackers manipulate what operators see on their monitoring screens, masking the true state of physical systems.
4. Operational disruption: Modified logic causes PLC malfunctions, process failures, and cascading operational impacts.

Network Indicators

CISA identified suspicious traffic patterns associated with this campaign on four OT-associated ports:

Traffic on these ports originates from overseas hosting providers — a strong indicator of infrastructure staged outside the target country to complicate attribution and response.

“Iran-affiliated advanced persistent threat (APT) actors are conducting exploitation activity targeting internet-facing operational technology (OT) devices, including programmable logic controllers (PLCs) manufactured by Rockwell Automation/Allen-Bradley. This activity has led to PLC disruptions across several U.S. critical infrastructure sectors through malicious interactions with the project file and manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss.” — CISA Advisory AA26-097A, April 7, 2026

The inclusion of port 102 (typically associated with Siemens S7 communications) alongside Rockwell-specific ports suggests the threat actors either maintain capabilities across multiple PLC vendors or are actively expanding their targeting beyond Allen-Bradley devices.

Why Project File Attacks Are Particularly Dangerous

Traditional IT security tools — endpoint detection, antivirus, network intrusion detection — have minimal visibility into PLC project file integrity. Most organizations lack baseline snapshots of their PLC configurations, making it nearly impossible to detect unauthorized changes without specialized OT monitoring. When attackers simultaneously tamper with HMI displays, operators lose their primary window into process state, creating a dangerous blind spot between what the system shows and what the system does.

The Sectors Under Fire and the Exposure Problem

CISA’s advisory specifically names Government Services and Facilities and Water and Wastewater Systems as affected sectors, with indications that additional critical infrastructure sectors are also targeted.

Why Water and Government Facilities

These sectors share characteristics that make them attractive targets for nation-state OT campaigns:

• Chronic underinvestment in cybersecurity relative to the criticality of services provided
• Legacy PLC deployments that predate modern security architectures, often running firmware that cannot be easily patched
• Internet-exposed devices driven by remote monitoring requirements, especially in geographically distributed water utilities
• Limited OT security staff — many water utilities operate with fewer than five IT personnel total

The fundamental exposure problem is straightforward: PLCs that are reachable from the internet are PLCs that Iranian APTs can reach. CISA has not disclosed how many Rockwell Automation PLCs remain internet-exposed across U.S. infrastructure, but historical Shodan and Censys analyses consistently find thousands of industrial control devices directly accessible on the public internet.

Regulatory Trajectory and Market Impact

This advisory lands in a regulatory environment already accelerating toward mandatory OT security requirements.

Near-Term Compliance Pressure (2026-2027)

CISA’s advisory strengthens the enforcement position for existing directives requiring critical infrastructure operators to report cyber incidents and maintain minimum security baselines. Organizations in the water sector face particular scrutiny following multiple high-profile OT incidents over the past three years. Expect auditors and sector risk management agencies to use AA26-097A as a benchmark — if your PLCs are internet-exposed and you haven’t implemented the advisory’s mitigations, you now have documented notice of the risk.

Medium-Term Regulatory Shift (2027-2030)

Escalating nation-state OT campaigns will drive stricter mandates for IT/OT segmentation, zero-trust architectures applied to SCADA/HMI environments, and expanded mandatory incident reporting obligations. Water, government, and adjacent sectors should anticipate compliance frameworks that require continuous OT asset inventory, network traffic monitoring on industrial protocols, and periodic PLC configuration integrity audits.

Long-Term Industry Transformation

Persistent state-sponsored exploitation will force PLC vendors — Rockwell Automation included — to fundamentally redesign controller architectures. Next-generation PLCs will need to embed cryptographic authentication for project file changes, firmware integrity verification at boot, and default-deny network postures. The era of PLCs shipping with open network services and no authentication is ending — the question is whether vendors move fast enough or whether regulators force the timeline.

The convergence of nation-state OT exploitation and tightening regulatory mandates means that organizations delaying OT security investment are simultaneously accumulating compromise risk and compliance debt — a position that becomes exponentially more expensive to unwind with each quarter of inaction.

The BeQuantum Perspective: Cryptographic Integrity for Industrial Control

The core vulnerability this campaign exploits is the absence of cryptographic verification for PLC project files and controller communications. Operators trust what their HMI screens display because nothing in the architecture guarantees that the data hasn’t been tampered with between the PLC and the display.

This is precisely the problem that cryptographic integrity verification solves — and where BeQuantum’s architecture offers a concrete technical path forward.

BeQuantum’s Digital Notary framework applies cryptographic timestamping and integrity verification to data at the point of creation. Applied to OT environments, this approach enables organizations to:

• Establish tamper-evident baselines for PLC project files, so any unauthorized modification produces a verifiable integrity failure
• Authenticate HMI/SCADA data streams against signed source records, eliminating the display-tampering attack vector described in AA26-097A
• Generate cryptographic audit trails that satisfy emerging compliance requirements for OT configuration management

BeQuantum’s PQC Layer ensures these integrity mechanisms remain secure against both current and future cryptographic threats — a critical consideration given that nation-state actors are known to harvest encrypted traffic for future quantum decryption. Organizations implementing OT integrity verification today should build on post-quantum foundations to avoid a second migration cycle within the decade.

What You Should Do in the Next 90 Days

Within 72 hours:

• Audit your OT network for any PLC with a routable internet address. Prioritize Rockwell Automation/Allen-Bradley devices but include all PLC vendors.
• Review firewall and gateway logs for traffic on ports 44818, 2222, 102, and 502 originating from overseas hosting providers.
• Download CISA’s IOC files (STIX XML, 35KB and STIX JSON, 12KB) and run them against your network traffic history and SIEM.
• Set physical mode switches on Rockwell Automation controllers to run position as recommended in AA26-097A — this prevents remote logic changes.

Within 30 days:

• Segment all PLCs behind firewalls with explicit allow-list rules. No PLC should accept connections from arbitrary internet addresses.
• Establish baseline snapshots of every PLC project file in your environment. Store these baselines in a tamper-evident system with cryptographic integrity verification.
• Deploy OT-specific network monitoring capable of deep packet inspection on industrial protocols (EtherNet/IP, Modbus, S7).

Within 90 days:

• Implement a formal PLC configuration change management process that requires cryptographic verification of project file integrity before any logic change is deployed.
• Conduct a tabletop exercise simulating a PLC compromise with HMI display manipulation — test whether your operations team can detect and respond to a scenario where screens show normal operations while physical processes are degraded.
• Evaluate your OT security architecture against a post-quantum cryptography roadmap. Integrity verification deployed today on classical algorithms will need migration — plan for PQC-ready implementations from the start.

[IMAGE: A dark industrial control room with multiple SCADA display screens showing process data, one screen glowing with subtle red warning indicators while a shadowed digital threat signature overlays the PLC hardware rack in the background, cinematic cyan and teal accent lighting reflecting off metal surfaces]

Frequently Asked Questions

Q: Are only Rockwell Automation/Allen-Bradley PLCs affected by this campaign?

A: CISA’s advisory specifically names Rockwell Automation/Allen-Bradley PLCs as confirmed targets but explicitly warns of “potential impact on other branded PLCs.” The presence of traffic on port 102 (associated with Siemens S7 protocol) in the advisory’s network indicators suggests cross-vendor capabilities. Organizations running PLCs from any manufacturer should treat this advisory as applicable to their environment.

Q: What does setting the physical mode switch to “run” actually prevent?

A: When a Rockwell Automation controller’s physical key switch is in the “run” position, the PLC executes its current program but rejects remote attempts to download new logic or modify the project file. This hardware-enforced control prevents the primary attack vector described in the advisory — remote manipulation of PLC programming. It does not protect against all attack vectors but eliminates the most critical one with a single physical action.

Q: How do I know if my PLCs have already been compromised?

A: Download CISA’s published IOC files in STIX format and correlate them against your network logs and SIEM data. Beyond IOC matching, compare current PLC project files against known-good baselines — any unexplained modification warrants investigation. If you lack project file baselines, establish them immediately and monitor for changes going forward. Engage an OT-specialized incident response firm if you identify indicators of compromise, as standard IT forensics teams may lack the expertise to analyze PLC-level artifacts.